

<!DOCTYPE html>
<html class="writer-html5" lang="en" >
<head>
  <meta charset="utf-8" />
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  
  <title>yubihsm.objects &mdash; python-yubihsm 2.1.0 documentation</title>
  

  
  <link rel="stylesheet" href="../../_static/css/theme.css" type="text/css" />
  <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

  
  
    <link rel="shortcut icon" href="../../_static/favicon.ico"/>
  

  
  

  

  
  <!--[if lt IE 9]>
    <script src="../../_static/js/html5shiv.min.js"></script>
  <![endif]-->
  
    
      <script type="text/javascript" id="documentation_options" data-url_root="../../" src="../../_static/documentation_options.js"></script>
        <script src="../../_static/jquery.js"></script>
        <script src="../../_static/underscore.js"></script>
        <script src="../../_static/doctools.js"></script>
    
    <script type="text/javascript" src="../../_static/js/theme.js"></script>

    
    <link rel="index" title="Index" href="../../genindex.html" />
    <link rel="search" title="Search" href="../../search.html" /> 
</head>

<body class="wy-body-for-nav">

   
  <div class="wy-grid-for-nav">
    
    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
      <div class="wy-side-scroll">
        <div class="wy-side-nav-search" >
          

          
            <a href="../../index.html" class="icon icon-home"> python-yubihsm
          

          
          </a>

          
            
            
              <div class="version">
                2.1
              </div>
            
          

          
<div role="search">
  <form id="rtd-search-form" class="wy-form" action="../../search.html" method="get">
    <input type="text" name="q" placeholder="Search docs" />
    <input type="hidden" name="check_keywords" value="yes" />
    <input type="hidden" name="area" value="default" />
  </form>
</div>

          
        </div>

        
        <div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <!-- Local TOC -->
              <div class="local-toc"></div>
            
          
        </div>
        
      </div>
    </nav>

    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap">

      
      <nav class="wy-nav-top" aria-label="top navigation">
        
          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
          <a href="../../index.html">python-yubihsm</a>
        
      </nav>


      <div class="wy-nav-content">
        
        <div class="rst-content">
        
          

















<div role="navigation" aria-label="breadcrumbs navigation">

  <ul class="wy-breadcrumbs">
    
      <li><a href="../../index.html" class="icon icon-home"></a> &raquo;</li>
        
          <li><a href="../index.html">Module code</a> &raquo;</li>
        
      <li>yubihsm.objects</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
      </li>
    
  </ul>

  
  <hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
  <h1>Source code for yubihsm.objects</h1><div class="highlight"><pre>
<span></span><span class="c1"># Copyright 2016-2018 Yubico AB</span>
<span class="c1">#</span>
<span class="c1"># Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);</span>
<span class="c1"># you may not use this file except in compliance with the License.</span>
<span class="c1"># You may obtain a copy of the License at</span>
<span class="c1">#</span>
<span class="c1">#     http://www.apache.org/licenses/LICENSE-2.0</span>
<span class="c1">#</span>
<span class="c1"># Unless required by applicable law or agreed to in writing, software</span>
<span class="c1"># distributed under the License is distributed on an &quot;AS IS&quot; BASIS,</span>
<span class="c1"># WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.</span>
<span class="c1"># See the License for the specific language governing permissions and</span>
<span class="c1"># limitations under the License.</span>

<span class="sd">&quot;&quot;&quot;Classes for interacting with objects on a YubiHSM.&quot;&quot;&quot;</span>


<span class="kn">from</span> <span class="nn">__future__</span> <span class="kn">import</span> <span class="n">absolute_import</span><span class="p">,</span> <span class="n">division</span>

<span class="kn">from</span> <span class="nn">.defs</span> <span class="kn">import</span> <span class="n">ALGORITHM</span><span class="p">,</span> <span class="n">COMMAND</span><span class="p">,</span> <span class="n">OBJECT</span><span class="p">,</span> <span class="n">ORIGIN</span>
<span class="kn">from</span> <span class="nn">.exceptions</span> <span class="kn">import</span> <span class="n">YubiHsmInvalidResponseError</span>
<span class="kn">from</span> <span class="nn">.eddsa</span> <span class="kn">import</span> <span class="p">(</span>
    <span class="n">_is_ed25519_private_key</span><span class="p">,</span>
    <span class="n">_serialize_ed25519_private_key</span><span class="p">,</span>
    <span class="n">_deserialize_ed25519_public_key</span><span class="p">,</span>
<span class="p">)</span>

<span class="kn">from</span> <span class="nn">cryptography.hazmat.backends</span> <span class="kn">import</span> <span class="n">default_backend</span>
<span class="kn">from</span> <span class="nn">cryptography</span> <span class="kn">import</span> <span class="n">x509</span>
<span class="kn">from</span> <span class="nn">cryptography.hazmat.primitives</span> <span class="kn">import</span> <span class="n">hashes</span>
<span class="kn">from</span> <span class="nn">cryptography.hazmat.primitives.asymmetric</span> <span class="kn">import</span> <span class="n">rsa</span><span class="p">,</span> <span class="n">ec</span>
<span class="kn">from</span> <span class="nn">cryptography.hazmat.primitives.asymmetric.utils</span> <span class="kn">import</span> <span class="n">Prehashed</span>
<span class="kn">from</span> <span class="nn">cryptography.hazmat.primitives.serialization</span> <span class="kn">import</span> <span class="n">Encoding</span><span class="p">,</span> <span class="n">PublicFormat</span>
<span class="kn">from</span> <span class="nn">cryptography.utils</span> <span class="kn">import</span> <span class="n">int_to_bytes</span>
<span class="kn">from</span> <span class="nn">.utils</span> <span class="kn">import</span> <span class="n">int_from_bytes</span><span class="p">,</span> <span class="n">password_to_key</span>
<span class="kn">from</span> <span class="nn">collections</span> <span class="kn">import</span> <span class="n">namedtuple</span>
<span class="kn">import</span> <span class="nn">six</span>
<span class="kn">import</span> <span class="nn">copy</span>
<span class="kn">import</span> <span class="nn">struct</span>


<span class="n">LABEL_LENGTH</span> <span class="o">=</span> <span class="mi">40</span>


<span class="k">def</span> <span class="nf">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Pack a label into binary form.&quot;&quot;&quot;</span>
    <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">label</span><span class="p">,</span> <span class="n">six</span><span class="o">.</span><span class="n">text_type</span><span class="p">):</span>
        <span class="n">label</span> <span class="o">=</span> <span class="n">label</span><span class="o">.</span><span class="n">encode</span><span class="p">(</span><span class="s2">&quot;utf8&quot;</span><span class="p">)</span>
    <span class="k">if</span> <span class="nb">len</span><span class="p">(</span><span class="n">label</span><span class="p">)</span> <span class="o">&gt;</span> <span class="n">LABEL_LENGTH</span><span class="p">:</span>
        <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Label must be no longer than </span><span class="si">%d</span><span class="s2"> bytes&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">)</span>
    <span class="k">return</span> <span class="n">label</span>


<span class="k">def</span> <span class="nf">_label_unpack</span><span class="p">(</span><span class="n">packed</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Unpack a label from its binary form.&quot;&quot;&quot;</span>
    <span class="k">try</span><span class="p">:</span>
        <span class="k">return</span> <span class="n">packed</span><span class="o">.</span><span class="n">split</span><span class="p">(</span><span class="sa">b</span><span class="s2">&quot;</span><span class="se">\0</span><span class="s2">&quot;</span><span class="p">,</span> <span class="mi">2</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span><span class="o">.</span><span class="n">decode</span><span class="p">(</span><span class="s2">&quot;utf8&quot;</span><span class="p">)</span>
    <span class="k">except</span> <span class="ne">UnicodeDecodeError</span><span class="p">:</span>
        <span class="c1"># Not valid UTF-8 string, return the raw data.</span>
        <span class="k">return</span> <span class="n">packed</span>


<span class="k">def</span> <span class="nf">_calc_hash</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="nb">hash</span><span class="p">):</span>
    <span class="k">if</span> <span class="ow">not</span> <span class="nb">isinstance</span><span class="p">(</span><span class="nb">hash</span><span class="p">,</span> <span class="n">Prehashed</span><span class="p">):</span>
        <span class="n">digest</span> <span class="o">=</span> <span class="n">hashes</span><span class="o">.</span><span class="n">Hash</span><span class="p">(</span><span class="nb">hash</span><span class="p">,</span> <span class="n">backend</span><span class="o">=</span><span class="n">default_backend</span><span class="p">())</span>
        <span class="n">digest</span><span class="o">.</span><span class="n">update</span><span class="p">(</span><span class="n">data</span><span class="p">)</span>
        <span class="n">data</span> <span class="o">=</span> <span class="n">digest</span><span class="o">.</span><span class="n">finalize</span><span class="p">()</span>

    <span class="k">return</span> <span class="n">data</span>


<div class="viewcode-block" id="ObjectInfo"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.ObjectInfo">[docs]</a><span class="k">class</span> <span class="nc">ObjectInfo</span><span class="p">(</span>
    <span class="n">namedtuple</span><span class="p">(</span>
        <span class="s2">&quot;ObjectInfo&quot;</span><span class="p">,</span>
        <span class="p">[</span>
            <span class="s2">&quot;capabilities&quot;</span><span class="p">,</span>
            <span class="s2">&quot;id&quot;</span><span class="p">,</span>
            <span class="s2">&quot;size&quot;</span><span class="p">,</span>
            <span class="s2">&quot;domains&quot;</span><span class="p">,</span>
            <span class="s2">&quot;object_type&quot;</span><span class="p">,</span>
            <span class="s2">&quot;algorithm&quot;</span><span class="p">,</span>
            <span class="s2">&quot;sequence&quot;</span><span class="p">,</span>
            <span class="s2">&quot;origin&quot;</span><span class="p">,</span>
            <span class="s2">&quot;label&quot;</span><span class="p">,</span>
            <span class="s2">&quot;delegated_capabilities&quot;</span><span class="p">,</span>
        <span class="p">],</span>
    <span class="p">)</span>
<span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Data structure holding various information about an object.</span>

<span class="sd">    :param int capabilities: The capabilities of the object.</span>
<span class="sd">    :param int id: The ID of the object.</span>
<span class="sd">    :param int size: The size of the object.</span>
<span class="sd">    :param int domains: The set of domains the object belongs to.</span>
<span class="sd">    :param OBJECT object_type: The type of the object.</span>
<span class="sd">    :param ALGORITHM algorithm: The algorithm of the object.</span>
<span class="sd">    :param int sequence: The sequence number of the object.</span>
<span class="sd">    :param ORIGIN origin: How the object was created/imported.</span>
<span class="sd">    :param label: The label of the object.</span>
<span class="sd">    :type label: str or bytes</span>
<span class="sd">    :param int delegated_capabilities: The set of delegated capabilities for the</span>
<span class="sd">        object.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="vm">__slots__</span> <span class="o">=</span> <span class="p">()</span>
    <span class="n">FORMAT</span> <span class="o">=</span> <span class="s2">&quot;!QHHHBBBB</span><span class="si">%d</span><span class="s2">sQ&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span>
    <span class="n">LENGTH</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">calcsize</span><span class="p">(</span><span class="n">FORMAT</span><span class="p">)</span>

<div class="viewcode-block" id="ObjectInfo.parse"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.ObjectInfo.parse">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">parse</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Parse an ObjectInfo from its binary representation.&quot;&quot;&quot;</span>
        <span class="n">tmp</span> <span class="o">=</span> <span class="bp">cls</span><span class="p">(</span><span class="o">*</span><span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="bp">cls</span><span class="o">.</span><span class="n">FORMAT</span><span class="p">,</span> <span class="n">data</span><span class="p">))</span>
        <span class="k">return</span> <span class="n">tmp</span><span class="o">.</span><span class="n">_replace</span><span class="p">(</span>
            <span class="n">object_type</span><span class="o">=</span><span class="n">OBJECT</span><span class="p">(</span><span class="n">tmp</span><span class="o">.</span><span class="n">object_type</span><span class="p">),</span>
            <span class="n">algorithm</span><span class="o">=</span><span class="n">ALGORITHM</span><span class="p">(</span><span class="n">tmp</span><span class="o">.</span><span class="n">algorithm</span><span class="p">),</span>
            <span class="n">origin</span><span class="o">=</span><span class="n">ORIGIN</span><span class="p">(</span><span class="n">tmp</span><span class="o">.</span><span class="n">origin</span><span class="p">),</span>
            <span class="n">label</span><span class="o">=</span><span class="n">_label_unpack</span><span class="p">(</span><span class="n">tmp</span><span class="o">.</span><span class="n">label</span><span class="p">),</span>
        <span class="p">)</span></div></div>


<div class="viewcode-block" id="YhsmObject"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.YhsmObject">[docs]</a><span class="k">class</span> <span class="nc">YhsmObject</span><span class="p">(</span><span class="nb">object</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;A reference to an object stored in a YubiHSM.</span>

<span class="sd">    YubiHSM objects are uniquely identified by their type and ID combined.</span>

<span class="sd">    :param OBJECT object_type: The type of the object.</span>
<span class="sd">    :param int id: The ID of the object.</span>
<span class="sd">    :param AuthSession session: The session to use for YubiHSM communication.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="n">object_type</span> <span class="o">=</span> <span class="kc">None</span>

    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">seq</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">session</span> <span class="o">=</span> <span class="n">session</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">id</span> <span class="o">=</span> <span class="n">object_id</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">_seq</span> <span class="o">=</span> <span class="n">seq</span>

<div class="viewcode-block" id="YhsmObject.with_session"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.YhsmObject.with_session">[docs]</a>    <span class="k">def</span> <span class="nf">with_session</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">session</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get a copy of the object reference, using the given session.</span>

<span class="sd">        :param AuthSession session: The session to use for the created reference.</span>
<span class="sd">        :return: A new reference to the object, associated wth the given session.</span>
<span class="sd">        :rtype: YhsmObject</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">other</span> <span class="o">=</span> <span class="n">copy</span><span class="o">.</span><span class="n">copy</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span>
        <span class="n">other</span><span class="o">.</span><span class="n">session</span> <span class="o">=</span> <span class="n">session</span>
        <span class="k">return</span> <span class="n">other</span></div>

<div class="viewcode-block" id="YhsmObject.get_info"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.YhsmObject.get_info">[docs]</a>    <span class="k">def</span> <span class="nf">get_info</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Read extended information about the object from the YubiHSM.</span>

<span class="sd">        :return: Information about the object.</span>
<span class="sd">        :rtype: ObjectInfo</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HB&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">object_type</span><span class="p">)</span>
        <span class="n">resp</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">GET_OBJECT_INFO</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span>
        <span class="k">try</span><span class="p">:</span>
            <span class="k">return</span> <span class="n">ObjectInfo</span><span class="o">.</span><span class="n">parse</span><span class="p">(</span><span class="n">resp</span><span class="p">)</span>
        <span class="k">except</span> <span class="ne">ValueError</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">()</span></div>

<div class="viewcode-block" id="YhsmObject.delete"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.YhsmObject.delete">[docs]</a>    <span class="k">def</span> <span class="nf">delete</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Deletes the object from the YubiHSM.</span>

<span class="sd">        .. warning:: This action in irreversible.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HB&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">object_type</span><span class="p">)</span>
        <span class="k">if</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">DELETE_OBJECT</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span> <span class="o">!=</span> <span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">()</span></div>

    <span class="nd">@staticmethod</span>
    <span class="k">def</span> <span class="nf">_create</span><span class="p">(</span><span class="n">object_type</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">seq</span><span class="o">=</span><span class="kc">None</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Creates instance of `object_type`.</span>

<span class="sd">        When object type is not recognized, _create constructs an</span>
<span class="sd">        instance of `_UnknownYhsmObject`.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">for</span> <span class="bp">cls</span> <span class="ow">in</span> <span class="n">YhsmObject</span><span class="o">.</span><span class="n">__subclasses__</span><span class="p">():</span>
            <span class="k">if</span> <span class="bp">cls</span><span class="o">.</span><span class="n">object_type</span> <span class="o">==</span> <span class="n">object_type</span><span class="p">:</span>
                <span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">seq</span><span class="p">)</span>
        <span class="k">return</span> <span class="n">_UnknownYhsmObject</span><span class="p">(</span><span class="n">object_type</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">seq</span><span class="p">)</span>

    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">_from_command</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">cmd</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="n">ret</span> <span class="o">=</span> <span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">cmd</span><span class="p">,</span> <span class="n">data</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="n">ret</span><span class="p">)[</span><span class="mi">0</span><span class="p">])</span>

    <span class="k">def</span> <span class="fm">__repr__</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="k">return</span> <span class="s2">&quot;</span><span class="si">{0.__class__.__name__}</span><span class="s2">(id=</span><span class="si">{0.id}</span><span class="s2">)&quot;</span><span class="o">.</span><span class="n">format</span><span class="p">(</span><span class="bp">self</span><span class="p">)</span></div>


<span class="k">class</span> <span class="nc">_UnknownYhsmObject</span><span class="p">(</span><span class="n">YhsmObject</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">    _UnknownYhsmObject is a generic YhsmObject with `self.object_type`</span>
<span class="sd">    set to the specified `object_type` parameter.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="k">def</span> <span class="fm">__init__</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">object_type</span><span class="p">,</span> <span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">):</span>
        <span class="nb">super</span><span class="p">(</span><span class="n">_UnknownYhsmObject</span><span class="p">,</span> <span class="bp">self</span><span class="p">)</span><span class="o">.</span><span class="fm">__init__</span><span class="p">(</span><span class="o">*</span><span class="n">args</span><span class="p">,</span> <span class="o">**</span><span class="n">kwargs</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">object_type</span> <span class="o">=</span> <span class="n">object_type</span>


<div class="viewcode-block" id="Opaque"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.Opaque">[docs]</a><span class="k">class</span> <span class="nc">Opaque</span><span class="p">(</span><span class="n">YhsmObject</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Object used to store arbitrary data on the YubiHSM.</span>

<span class="sd">    Supported algorithms:</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.OPAQUE_DATA`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.OPAQUE_X509_CERTIFICATE`</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="n">object_type</span> <span class="o">=</span> <span class="n">OBJECT</span><span class="o">.</span><span class="n">OPAQUE</span>

<div class="viewcode-block" id="Opaque.put"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.Opaque.put">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">algorithm</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Import an Opaque object into the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param ALGORITHM algorithm: The algorithm to use for the object.</span>
<span class="sd">        :param bytes data: The binary data to store.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: Opaque</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">if</span> <span class="ow">not</span> <span class="n">data</span><span class="p">:</span>
            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Cannot store empty data&quot;</span><span class="p">)</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQB&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">algorithm</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="n">msg</span> <span class="o">+=</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">PUT_OPAQUE</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="Opaque.get"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.Opaque.get">[docs]</a>    <span class="k">def</span> <span class="nf">get</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Read the data of an Opaque object from the YubiHSM.</span>

<span class="sd">        :return: The data stored for the object.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">GET_OPAQUE</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="Opaque.put_certificate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.Opaque.put_certificate">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put_certificate</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">certificate</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Import an X509 certificate into the YubiHSM as an Opaque.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param cryptography.x509.Certificate certificate: A certificate to</span>
<span class="sd">            import.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: Opaque</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">encoded_cert</span> <span class="o">=</span> <span class="n">certificate</span><span class="o">.</span><span class="n">public_bytes</span><span class="p">(</span><span class="n">Encoding</span><span class="o">.</span><span class="n">DER</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">put</span><span class="p">(</span>
            <span class="n">session</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">label</span><span class="p">,</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">OPAQUE_X509_CERTIFICATE</span><span class="p">,</span>
            <span class="n">encoded_cert</span><span class="p">,</span>
        <span class="p">)</span></div>

<div class="viewcode-block" id="Opaque.get_certificate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.Opaque.get_certificate">[docs]</a>    <span class="k">def</span> <span class="nf">get_certificate</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Read an Opaque object from the YubiHSM, parsed as a certificate.</span>

<span class="sd">        :return: The certificate stored for the object.</span>
<span class="sd">        :rtype: cryptography.x509.Certificate</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">x509</span><span class="o">.</span><span class="n">load_der_x509_certificate</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">get</span><span class="p">(),</span> <span class="n">default_backend</span><span class="p">())</span></div></div>


<div class="viewcode-block" id="AuthenticationKey"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AuthenticationKey">[docs]</a><span class="k">class</span> <span class="nc">AuthenticationKey</span><span class="p">(</span><span class="n">YhsmObject</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Used to authenticate a session with the YubiHSM.</span>

<span class="sd">    AuthenticationKeys use two separate keys to mutually authenticate and set up</span>
<span class="sd">    a secure session with a YubiHSM. These two keys can either be given</span>
<span class="sd">    explicitly, or be derived from a password.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="n">object_type</span> <span class="o">=</span> <span class="n">OBJECT</span><span class="o">.</span><span class="n">AUTHENTICATION_KEY</span>

<div class="viewcode-block" id="AuthenticationKey.put_derived"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AuthenticationKey.put_derived">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put_derived</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span>
        <span class="n">session</span><span class="p">,</span>
        <span class="n">object_id</span><span class="p">,</span>
        <span class="n">label</span><span class="p">,</span>
        <span class="n">domains</span><span class="p">,</span>
        <span class="n">capabilities</span><span class="p">,</span>
        <span class="n">delegated_capabilities</span><span class="p">,</span>
        <span class="n">password</span><span class="p">,</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Create an AuthenticationKey derived from a password.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param int delegated_capabilities: The set of capabilities that the</span>
<span class="sd">            AuthenticationKey can give to objects created when authenticated</span>
<span class="sd">            using it.</span>
<span class="sd">        :param str password: The password to derive raw keys from.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: AuthenticationKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span> <span class="o">=</span> <span class="n">password_to_key</span><span class="p">(</span><span class="n">password</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">put</span><span class="p">(</span>
            <span class="n">session</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">label</span><span class="p">,</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">delegated_capabilities</span><span class="p">,</span>
            <span class="n">key_enc</span><span class="p">,</span>
            <span class="n">key_mac</span><span class="p">,</span>
        <span class="p">)</span></div>

<div class="viewcode-block" id="AuthenticationKey.put"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AuthenticationKey.put">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span>
        <span class="n">session</span><span class="p">,</span>
        <span class="n">object_id</span><span class="p">,</span>
        <span class="n">label</span><span class="p">,</span>
        <span class="n">domains</span><span class="p">,</span>
        <span class="n">capabilities</span><span class="p">,</span>
        <span class="n">delegated_capabilities</span><span class="p">,</span>
        <span class="n">key_enc</span><span class="p">,</span>
        <span class="n">key_mac</span><span class="p">,</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Create an AuthenticationKey by providing raw keys.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param int delegated_capabilities: The set of capabilities that the</span>
<span class="sd">            AuthenticationKey can give to objects created when authenticated</span>
<span class="sd">            using it.</span>
<span class="sd">        :param bytes key_enc: The raw encryption key.</span>
<span class="sd">        :param bytes key_mac: The raw MAC key.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: AuthenticationKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQBQ&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">AES128_YUBICO_AUTHENTICATION</span><span class="p">,</span>
            <span class="n">delegated_capabilities</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="n">msg</span> <span class="o">+=</span> <span class="n">key_enc</span> <span class="o">+</span> <span class="n">key_mac</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">PUT_AUTHENTICATION_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthenticationKey.change_password"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AuthenticationKey.change_password">[docs]</a>    <span class="k">def</span> <span class="nf">change_password</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">password</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Change the password used to authenticate a session.</span>

<span class="sd">        Changes the raw keys used for authentication, by deriving them from a</span>
<span class="sd">        password.</span>

<span class="sd">        :param str password: The password to derive raw keys from.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span> <span class="o">=</span> <span class="n">password_to_key</span><span class="p">(</span><span class="n">password</span><span class="p">)</span>
        <span class="bp">self</span><span class="o">.</span><span class="n">change_key</span><span class="p">(</span><span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span><span class="p">)</span></div>

<div class="viewcode-block" id="AuthenticationKey.change_key"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AuthenticationKey.change_key">[docs]</a>    <span class="k">def</span> <span class="nf">change_key</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">key_enc</span><span class="p">,</span> <span class="n">key_mac</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Change the raw keys used to authenticate a session.</span>

<span class="sd">        :param bytes key_enc: The raw encryption key.</span>
<span class="sd">        :param bytes key_mac: The raw MAC key.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="p">(</span>
            <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HB&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">AES128_YUBICO_AUTHENTICATION</span><span class="p">)</span>
            <span class="o">+</span> <span class="n">key_enc</span>
            <span class="o">+</span> <span class="n">key_mac</span>
        <span class="p">)</span>
        <span class="n">resp</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">CHANGE_AUTHENTICATION_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span>
        <span class="k">if</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="n">resp</span><span class="p">)[</span><span class="mi">0</span><span class="p">]</span> <span class="o">!=</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">:</span>
            <span class="k">raise</span> <span class="n">YubiHsmInvalidResponseError</span><span class="p">(</span><span class="s2">&quot;Wrong ID returned&quot;</span><span class="p">)</span></div></div>


<div class="viewcode-block" id="AsymmetricKey"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey">[docs]</a><span class="k">class</span> <span class="nc">AsymmetricKey</span><span class="p">(</span><span class="n">YhsmObject</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Used to sign/decrypt data with the private key of an asymmetric key pair.</span>

<span class="sd">    Supported algorithms:</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.RSA_2048`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.RSA_3072`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.RSA_4096`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_P224`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_P256`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_P384`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_P521`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_K256`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_BP256`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_BP384`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_BP512`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.EC_ED25519`</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="n">object_type</span> <span class="o">=</span> <span class="n">OBJECT</span><span class="o">.</span><span class="n">ASYMMETRIC_KEY</span>

<div class="viewcode-block" id="AsymmetricKey.put"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.put">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">key</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Import a private key into the YubiHSM.</span>

<span class="sd">        RSA and EC keys can be created by using the cryptography APIs. You can</span>
<span class="sd">        then pass either a</span>
<span class="sd">        :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey`</span>
<span class="sd">        or a</span>
<span class="sd">        :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey`</span>
<span class="sd">        as `key`.</span>

<span class="sd">        EdDSA keys can be created using the Cryptography APIs if available, or</span>
<span class="sd">        by calling</span>
<span class="sd">        :func:`~yubihsm.eddsa.load_ed25519_private_key`.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param key: The private key to import.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: AsymmetricKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">if</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">key</span><span class="p">,</span> <span class="n">rsa</span><span class="o">.</span><span class="n">RSAPrivateKey</span><span class="p">):</span>
            <span class="n">numbers</span> <span class="o">=</span> <span class="n">key</span><span class="o">.</span><span class="n">private_numbers</span><span class="p">()</span>
            <span class="n">serialized</span> <span class="o">=</span> <span class="n">int_to_bytes</span><span class="p">(</span><span class="n">numbers</span><span class="o">.</span><span class="n">p</span><span class="p">)</span> <span class="o">+</span> <span class="n">int_to_bytes</span><span class="p">(</span><span class="n">numbers</span><span class="o">.</span><span class="n">q</span><span class="p">)</span>
            <span class="n">algo</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">ALGORITHM</span><span class="p">,</span> <span class="s2">&quot;RSA_</span><span class="si">%d</span><span class="s2">&quot;</span> <span class="o">%</span> <span class="n">key</span><span class="o">.</span><span class="n">key_size</span><span class="p">)</span>
        <span class="k">elif</span> <span class="nb">isinstance</span><span class="p">(</span><span class="n">key</span><span class="p">,</span> <span class="n">ec</span><span class="o">.</span><span class="n">EllipticCurvePrivateKey</span><span class="p">):</span>
            <span class="n">numbers</span> <span class="o">=</span> <span class="n">key</span><span class="o">.</span><span class="n">private_numbers</span><span class="p">()</span>
            <span class="n">serialized</span> <span class="o">=</span> <span class="n">int_to_bytes</span><span class="p">(</span>
                <span class="n">numbers</span><span class="o">.</span><span class="n">private_value</span><span class="p">,</span> <span class="p">(</span><span class="n">key</span><span class="o">.</span><span class="n">curve</span><span class="o">.</span><span class="n">key_size</span> <span class="o">+</span> <span class="mi">7</span><span class="p">)</span> <span class="o">//</span> <span class="mi">8</span>
            <span class="p">)</span>
            <span class="n">algo</span> <span class="o">=</span> <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">for_curve</span><span class="p">(</span><span class="n">key</span><span class="o">.</span><span class="n">curve</span><span class="p">)</span>
        <span class="k">elif</span> <span class="n">_is_ed25519_private_key</span><span class="p">(</span><span class="n">key</span><span class="p">):</span>
            <span class="n">serialized</span> <span class="o">=</span> <span class="n">_serialize_ed25519_private_key</span><span class="p">(</span><span class="n">key</span><span class="p">)</span>
            <span class="n">algo</span> <span class="o">=</span> <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_ED25519</span>
        <span class="k">else</span><span class="p">:</span>
            <span class="k">raise</span> <span class="ne">ValueError</span><span class="p">(</span><span class="s2">&quot;Unsupported key&quot;</span><span class="p">)</span>

        <span class="n">msg</span> <span class="o">=</span> <span class="p">(</span>
            <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
                <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQB&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
                <span class="n">object_id</span><span class="p">,</span>
                <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
                <span class="n">domains</span><span class="p">,</span>
                <span class="n">capabilities</span><span class="p">,</span>
                <span class="n">algo</span><span class="p">,</span>
            <span class="p">)</span>
            <span class="o">+</span> <span class="n">serialized</span>
        <span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">PUT_ASYMMETRIC_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.generate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.generate">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">generate</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">algorithm</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Generate a new private key in the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param ALGORITHM algorithm: The algorithm to use for the private key.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: AsymmetricKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQB&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">algorithm</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">GENERATE_ASYMMETRIC_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.get_public_key"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.get_public_key">[docs]</a>    <span class="k">def</span> <span class="nf">get_public_key</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get the public key of the key pair.</span>

<span class="sd">        This will return either a</span>
<span class="sd">        :class:`~cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey`</span>
<span class="sd">        or a</span>
<span class="sd">        :class:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey`</span>
<span class="sd">        depending on the algorithm of the key.</span>

<span class="sd">        Ed25519 keys will be returned as a Cryptography</span>
<span class="sd">        :class:`~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey`</span>
<span class="sd">        object if possible (requires Cryptography 2.6 or later), or an internal</span>
<span class="sd">        representation if not, either which can be serialized using the</span>
<span class="sd">        :func:`~yubihsm.eddsa.serialize_ed25519_public_key` function.</span>

<span class="sd">        :return: The public key of the key pair.</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
        <span class="n">ret</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">GET_PUBLIC_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span>
        <span class="n">algo</span> <span class="o">=</span> <span class="n">ALGORITHM</span><span class="p">(</span><span class="n">six</span><span class="o">.</span><span class="n">indexbytes</span><span class="p">(</span><span class="n">ret</span><span class="p">,</span> <span class="mi">0</span><span class="p">))</span>
        <span class="n">raw_key</span> <span class="o">=</span> <span class="n">ret</span><span class="p">[</span><span class="mi">1</span><span class="p">:]</span>
        <span class="k">if</span> <span class="n">algo</span> <span class="ow">in</span> <span class="p">[</span><span class="n">ALGORITHM</span><span class="o">.</span><span class="n">RSA_2048</span><span class="p">,</span> <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">RSA_3072</span><span class="p">,</span> <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">RSA_4096</span><span class="p">]:</span>
            <span class="n">num</span> <span class="o">=</span> <span class="n">int_from_bytes</span><span class="p">(</span><span class="n">raw_key</span><span class="p">,</span> <span class="s2">&quot;big&quot;</span><span class="p">)</span>
            <span class="n">pubkey</span> <span class="o">=</span> <span class="n">rsa</span><span class="o">.</span><span class="n">RSAPublicNumbers</span><span class="p">(</span><span class="n">e</span><span class="o">=</span><span class="mh">0x10001</span><span class="p">,</span> <span class="n">n</span><span class="o">=</span><span class="n">num</span><span class="p">)</span>
        <span class="k">elif</span> <span class="n">algo</span> <span class="ow">in</span> <span class="p">[</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_P224</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_P256</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_P384</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_P521</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_K256</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_BP256</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_BP384</span><span class="p">,</span>
            <span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_BP512</span><span class="p">,</span>
        <span class="p">]:</span>
            <span class="n">c_len</span> <span class="o">=</span> <span class="nb">len</span><span class="p">(</span><span class="n">raw_key</span><span class="p">)</span> <span class="o">//</span> <span class="mi">2</span>
            <span class="n">x</span> <span class="o">=</span> <span class="n">int_from_bytes</span><span class="p">(</span><span class="n">raw_key</span><span class="p">[:</span><span class="n">c_len</span><span class="p">],</span> <span class="s2">&quot;big&quot;</span><span class="p">)</span>
            <span class="n">y</span> <span class="o">=</span> <span class="n">int_from_bytes</span><span class="p">(</span><span class="n">raw_key</span><span class="p">[</span><span class="n">c_len</span><span class="p">:],</span> <span class="s2">&quot;big&quot;</span><span class="p">)</span>
            <span class="n">pubkey</span> <span class="o">=</span> <span class="n">ec</span><span class="o">.</span><span class="n">EllipticCurvePublicNumbers</span><span class="p">(</span><span class="n">curve</span><span class="o">=</span><span class="n">algo</span><span class="o">.</span><span class="n">to_curve</span><span class="p">(),</span> <span class="n">x</span><span class="o">=</span><span class="n">x</span><span class="p">,</span> <span class="n">y</span><span class="o">=</span><span class="n">y</span><span class="p">)</span>
        <span class="k">elif</span> <span class="n">algo</span> <span class="ow">in</span> <span class="p">[</span><span class="n">ALGORITHM</span><span class="o">.</span><span class="n">EC_ED25519</span><span class="p">]:</span>
            <span class="k">return</span> <span class="n">_deserialize_ed25519_public_key</span><span class="p">(</span><span class="n">raw_key</span><span class="p">)</span>

        <span class="k">return</span> <span class="n">pubkey</span><span class="o">.</span><span class="n">public_key</span><span class="p">(</span><span class="n">backend</span><span class="o">=</span><span class="n">default_backend</span><span class="p">())</span></div>

<div class="viewcode-block" id="AsymmetricKey.get_certificate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.get_certificate">[docs]</a>    <span class="k">def</span> <span class="nf">get_certificate</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Get the X509 certificate associated with the key.</span>

<span class="sd">        An X509 certificate is associated with an asymmetric key if it is stored</span>
<span class="sd">        as an Opaque object with the same object ID as the key, and it has the</span>
<span class="sd">        :class:`~yubihsm.defs.ALGORITHM.OPAQUE_X509_CERTIFICATE` algorithm set.</span>

<span class="sd">        Equivalent to calling `Opaque(session, key_id).get_certificate()`.</span>

<span class="sd">        :return: The certificate stored for the object.</span>
<span class="sd">        :rtype: cryptography.x509.Certificate</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">Opaque</span><span class="p">(</span><span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span><span class="o">.</span><span class="n">get_certificate</span><span class="p">()</span></div>

<div class="viewcode-block" id="AsymmetricKey.put_certificate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.put_certificate">[docs]</a>    <span class="k">def</span> <span class="nf">put_certificate</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">certificate</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Store an X509 certificate associated with this key.</span>

<span class="sd">        Equivalent to calling `Opaque.put_certificate(session, key_id, ...)`.</span>

<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param cryptography.x509.Certificate certificate: A certificate to</span>
<span class="sd">            import.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: Opaque</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">return</span> <span class="n">Opaque</span><span class="o">.</span><span class="n">put_certificate</span><span class="p">(</span>
            <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">certificate</span>
        <span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.sign_ecdsa"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.sign_ecdsa">[docs]</a>    <span class="k">def</span> <span class="nf">sign_ecdsa</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="nb">hash</span><span class="o">=</span><span class="n">hashes</span><span class="o">.</span><span class="n">SHA256</span><span class="p">(),</span> <span class="n">length</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Sign data using ECDSA.</span>

<span class="sd">        :param bytes data: The data to sign.</span>
<span class="sd">        :param hash: (optional) The algorithm to use when hashing the data.</span>
<span class="sd">        :type hash: cryptography.hazmat.primitives.hashes.HashAlgorithm</span>
<span class="sd">        :param int length: (optional) length to pad/truncate the hash to.</span>
<span class="sd">        :return: The resulting signature.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">data</span> <span class="o">=</span> <span class="n">_calc_hash</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="nb">hash</span><span class="p">)</span>

        <span class="k">if</span> <span class="ow">not</span> <span class="n">length</span><span class="p">:</span>
            <span class="n">length</span> <span class="o">=</span> <span class="nb">hash</span><span class="o">.</span><span class="n">digest_size</span>

        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">s&quot;</span> <span class="o">%</span> <span class="n">length</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">data</span><span class="o">.</span><span class="n">rjust</span><span class="p">(</span><span class="n">length</span><span class="p">,</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\0</span><span class="s2">&quot;</span><span class="p">))</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SIGN_ECDSA</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.derive_ecdh"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.derive_ecdh">[docs]</a>    <span class="k">def</span> <span class="nf">derive_ecdh</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">public_key</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Perform an ECDH key exchange as specified in SP 800-56A.</span>

<span class="sd">        :param public_key: The public key to use for the key exchange.</span>
<span class="sd">        :type public_key:</span>
<span class="sd">            cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey</span>
<span class="sd">        :return: The resulting shared key.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="k">try</span><span class="p">:</span>
            <span class="n">point</span> <span class="o">=</span> <span class="n">public_key</span><span class="o">.</span><span class="n">public_bytes</span><span class="p">(</span>
                <span class="n">Encoding</span><span class="o">.</span><span class="n">X962</span><span class="p">,</span> <span class="n">PublicFormat</span><span class="o">.</span><span class="n">UncompressedPoint</span>
            <span class="p">)</span>
        <span class="k">except</span> <span class="ne">AttributeError</span><span class="p">:</span>  <span class="c1"># Cryptography &lt;2.5</span>
            <span class="n">point</span> <span class="o">=</span> <span class="n">public_key</span><span class="o">.</span><span class="n">public_numbers</span><span class="p">()</span><span class="o">.</span><span class="n">encode_point</span><span class="p">()</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">point</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">DERIVE_ECDH</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.sign_pkcs1v1_5"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.sign_pkcs1v1_5">[docs]</a>    <span class="k">def</span> <span class="nf">sign_pkcs1v1_5</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="nb">hash</span><span class="o">=</span><span class="n">hashes</span><span class="o">.</span><span class="n">SHA256</span><span class="p">()):</span>
        <span class="sd">&quot;&quot;&quot;Sign data using RSASSA-PKCS1-v1_5.</span>

<span class="sd">        :param bytes data: The data to sign.</span>
<span class="sd">        :param hash: (optional) The algorithm to use when hashing the data.</span>
<span class="sd">        :type hash: cryptography.hazmat.primitives.hashes.HashAlgorithm</span>
<span class="sd">        :return: The resulting signature.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">data</span> <span class="o">=</span> <span class="n">_calc_hash</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="nb">hash</span><span class="p">)</span>

        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SIGN_PKCS1</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.decrypt_pkcs1v1_5"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.decrypt_pkcs1v1_5">[docs]</a>    <span class="k">def</span> <span class="nf">decrypt_pkcs1v1_5</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Decrypt data encrypted with RSAES-PKCS1-v1_5.</span>

<span class="sd">        :param bytes data: The ciphertext to decrypt.</span>
<span class="sd">        :return: The decrypted plaintext.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">DECRYPT_PKCS1</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.sign_pss"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.sign_pss">[docs]</a>    <span class="k">def</span> <span class="nf">sign_pss</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="n">salt_len</span><span class="p">,</span> <span class="nb">hash</span><span class="o">=</span><span class="n">hashes</span><span class="o">.</span><span class="n">SHA256</span><span class="p">(),</span> <span class="n">mgf_hash</span><span class="o">=</span><span class="n">hashes</span><span class="o">.</span><span class="n">SHA256</span><span class="p">()):</span>
        <span class="sd">&quot;&quot;&quot;Sign data using RSASSA-PSS with MGF1.</span>

<span class="sd">        :param bytes data: The data to sign.</span>
<span class="sd">        :param int salt_len: The length of the salt to use.</span>
<span class="sd">        :param hash: (optional) The algorithm to use when hashing the data.</span>
<span class="sd">        :type hash: cryptography.hazmat.primitives.hashes.HashAlgorithm</span>
<span class="sd">        :param mgf_hash: (optional) The algorithm to use for MGF1.</span>
<span class="sd">        :type mgf_hash: cryptography.hazmat.primitives.hashes.HashAlgorithm</span>
<span class="sd">        :return: The resulting signature.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">data</span> <span class="o">=</span> <span class="n">_calc_hash</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="nb">hash</span><span class="p">)</span>

        <span class="n">mgf</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">ALGORITHM</span><span class="p">,</span> <span class="s2">&quot;RSA_MGF1_</span><span class="si">%s</span><span class="s2">&quot;</span> <span class="o">%</span> <span class="n">mgf_hash</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">upper</span><span class="p">())</span>

        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HBH&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">mgf</span><span class="p">,</span> <span class="n">salt_len</span><span class="p">)</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SIGN_PSS</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.decrypt_oaep"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.decrypt_oaep">[docs]</a>    <span class="k">def</span> <span class="nf">decrypt_oaep</span><span class="p">(</span>
        <span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">,</span> <span class="n">label</span><span class="o">=</span><span class="sa">b</span><span class="s2">&quot;&quot;</span><span class="p">,</span> <span class="nb">hash</span><span class="o">=</span><span class="n">hashes</span><span class="o">.</span><span class="n">SHA256</span><span class="p">(),</span> <span class="n">mgf_hash</span><span class="o">=</span><span class="n">hashes</span><span class="o">.</span><span class="n">SHA256</span><span class="p">()</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Decrypt data encrypted with RSAES-OAEP.</span>

<span class="sd">        :param bytes data: The ciphertext to decrypt.</span>
<span class="sd">        :param bytes label: (optional) OAEP label.</span>
<span class="sd">        :param hash: (optional) The algorithm to use when hashing the data.</span>
<span class="sd">        :type hash: cryptography.hazmat.primitives.hashes.HashAlgorithm</span>
<span class="sd">        :param mgf_hash: (optional) The algorithm to use for MGF1.</span>
<span class="sd">        :type mgf_hash: cryptography.hazmat.primitives.hashes.HashAlgorithm</span>
<span class="sd">        :return: The decrypted plaintext.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">digest</span> <span class="o">=</span> <span class="n">hashes</span><span class="o">.</span><span class="n">Hash</span><span class="p">(</span><span class="nb">hash</span><span class="p">,</span> <span class="n">backend</span><span class="o">=</span><span class="n">default_backend</span><span class="p">())</span>
        <span class="n">digest</span><span class="o">.</span><span class="n">update</span><span class="p">(</span><span class="n">label</span><span class="p">)</span>

        <span class="n">mgf</span> <span class="o">=</span> <span class="nb">getattr</span><span class="p">(</span><span class="n">ALGORITHM</span><span class="p">,</span> <span class="s2">&quot;RSA_MGF1_</span><span class="si">%s</span><span class="s2">&quot;</span> <span class="o">%</span> <span class="n">mgf_hash</span><span class="o">.</span><span class="n">name</span><span class="o">.</span><span class="n">upper</span><span class="p">())</span>

        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HB&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">mgf</span><span class="p">)</span> <span class="o">+</span> <span class="n">data</span> <span class="o">+</span> <span class="n">digest</span><span class="o">.</span><span class="n">finalize</span><span class="p">()</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">DECRYPT_OAEP</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.sign_eddsa"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.sign_eddsa">[docs]</a>    <span class="k">def</span> <span class="nf">sign_eddsa</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Sign data using EdDSA.</span>

<span class="sd">        :param bytes data: The data to sign.</span>
<span class="sd">        :return: The resulting signature.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SIGN_EDDSA</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="AsymmetricKey.attest"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.attest">[docs]</a>    <span class="k">def</span> <span class="nf">attest</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">attesting_key_id</span><span class="o">=</span><span class="mi">0</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Attest this asymmetric key.</span>

<span class="sd">        Creates an X509 certificate containing this key pair&#39;s public key,</span>
<span class="sd">        signed by the asymmetric key identified by the given ID.</span>
<span class="sd">        You also need a X509 certificate stored with the same ID as the</span>
<span class="sd">        attesting key in the YubiHSM, to be used as a template.</span>

<span class="sd">        :param int attesting_key_id: (optional) The ID of the asymmetric key</span>
<span class="sd">            used to attest. If omitted, the built-in Yubico attestation key is</span>
<span class="sd">            used.</span>
<span class="sd">        :return: The attestation certificate.</span>
<span class="sd">        :rtype: cryptography.x509.Certificate</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HH&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">attesting_key_id</span><span class="p">)</span>
        <span class="n">resp</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SIGN_ATTESTATION_CERTIFICATE</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span>
        <span class="k">return</span> <span class="n">x509</span><span class="o">.</span><span class="n">load_der_x509_certificate</span><span class="p">(</span><span class="n">resp</span><span class="p">,</span> <span class="n">default_backend</span><span class="p">())</span></div>

<div class="viewcode-block" id="AsymmetricKey.sign_ssh_certificate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.AsymmetricKey.sign_ssh_certificate">[docs]</a>    <span class="k">def</span> <span class="nf">sign_ssh_certificate</span><span class="p">(</span>
        <span class="bp">self</span><span class="p">,</span> <span class="n">template_id</span><span class="p">,</span> <span class="n">request</span><span class="p">,</span> <span class="n">algorithm</span><span class="o">=</span><span class="n">ALGORITHM</span><span class="o">.</span><span class="n">RSA_PKCS1_SHA1</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Sign an SSH certificate request.</span>

<span class="sd">        :param int template_id: The ID of the SSH TEMPLATE to use.</span>
<span class="sd">        :param bytes request: The SSH certificate request.</span>
<span class="sd">        :return: The signed SSH certificate.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HH&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">template_id</span><span class="p">)</span> <span class="o">+</span> <span class="n">request</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SIGN_SSH_CERTIFICATE</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div></div>


<div class="viewcode-block" id="WrapKey"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.WrapKey">[docs]</a><span class="k">class</span> <span class="nc">WrapKey</span><span class="p">(</span><span class="n">YhsmObject</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Used to import and export other objects under wrap.</span>

<span class="sd">    Supported algorithms:</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.AES128_CCM_WRAP`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.AES192_CCM_WRAP`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.AES256_CCM_WRAP`</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="n">object_type</span> <span class="o">=</span> <span class="n">OBJECT</span><span class="o">.</span><span class="n">WRAP_KEY</span>

<div class="viewcode-block" id="WrapKey.generate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.WrapKey.generate">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">generate</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span>
        <span class="n">session</span><span class="p">,</span>
        <span class="n">object_id</span><span class="p">,</span>
        <span class="n">label</span><span class="p">,</span>
        <span class="n">domains</span><span class="p">,</span>
        <span class="n">capabilities</span><span class="p">,</span>
        <span class="n">algorithm</span><span class="p">,</span>
        <span class="n">delegated_capabilities</span><span class="p">,</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Generate a new wrap key in the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param ALGORITHM algorithm: The algorithm to use for the wrap key.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: WrapKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQBQ&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">algorithm</span><span class="p">,</span>
            <span class="n">delegated_capabilities</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">GENERATE_WRAP_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="WrapKey.put"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.WrapKey.put">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span>
        <span class="n">session</span><span class="p">,</span>
        <span class="n">object_id</span><span class="p">,</span>
        <span class="n">label</span><span class="p">,</span>
        <span class="n">domains</span><span class="p">,</span>
        <span class="n">capabilities</span><span class="p">,</span>
        <span class="n">algorithm</span><span class="p">,</span>
        <span class="n">delegated_capabilities</span><span class="p">,</span>
        <span class="n">key</span><span class="p">,</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Import a wrap key into the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param ALGORITHM algorithm: The algorithm to use for the wrap key.</span>
<span class="sd">        :param int delegated_capabilities: The set of capabilities that the</span>
<span class="sd">            WrapKey can give to objects that it imports.</span>
<span class="sd">        :param bytes key: The raw encryption key corresponding to the algorithm.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: WrapKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQBQ&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">algorithm</span><span class="p">,</span>
            <span class="n">delegated_capabilities</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="n">msg</span> <span class="o">+=</span> <span class="n">key</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">PUT_WRAP_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="WrapKey.wrap_data"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.WrapKey.wrap_data">[docs]</a>    <span class="k">def</span> <span class="nf">wrap_data</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Wrap (encrypt) arbitrary data.</span>

<span class="sd">        :param bytes data: The data to encrypt.</span>
<span class="sd">        :return: The encrypted data.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">WRAP_DATA</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="WrapKey.unwrap_data"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.WrapKey.unwrap_data">[docs]</a>    <span class="k">def</span> <span class="nf">unwrap_data</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Unwrap (decrypt) arbitrary data.</span>

<span class="sd">        :param bytes data: The encrypted data to decrypt.</span>
<span class="sd">        :return: The decrypted data.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">UNWRAP_DATA</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="WrapKey.export_wrapped"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.WrapKey.export_wrapped">[docs]</a>    <span class="k">def</span> <span class="nf">export_wrapped</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">obj</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Exports an object under wrap.</span>

<span class="sd">        :param YhsmObject obj: The object to export.</span>
<span class="sd">        :return: The encrypted object data.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HBH&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">obj</span><span class="o">.</span><span class="n">object_type</span><span class="p">,</span> <span class="n">obj</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">EXPORT_WRAPPED</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="WrapKey.import_wrapped"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.WrapKey.import_wrapped">[docs]</a>    <span class="k">def</span> <span class="nf">import_wrapped</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">wrapped_obj</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Imports an object previously exported under wrap.</span>

<span class="sd">        :param bytes wraped_obj: The encrypted object data.</span>
<span class="sd">        :return: A reference to the imported object.</span>
<span class="sd">        :rtype: YhsmObject</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">wrapped_obj</span>
        <span class="n">ret</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">IMPORT_WRAPPED</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span>
        <span class="n">object_type</span><span class="p">,</span> <span class="n">object_id</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;!BH&quot;</span><span class="p">,</span> <span class="n">ret</span><span class="p">)</span>
        <span class="k">return</span> <span class="n">YhsmObject</span><span class="o">.</span><span class="n">_create</span><span class="p">(</span><span class="n">object_type</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">)</span></div></div>


<div class="viewcode-block" id="HmacKey"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.HmacKey">[docs]</a><span class="k">class</span> <span class="nc">HmacKey</span><span class="p">(</span><span class="n">YhsmObject</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Used to calculate and verify HMAC signatures.</span>

<span class="sd">    Supported algorithms:</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.HMAC_SHA1`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.HMAC_SHA256`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.HMAC_SHA384`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.HMAC_SHA512`</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="n">object_type</span> <span class="o">=</span> <span class="n">OBJECT</span><span class="o">.</span><span class="n">HMAC_KEY</span>

<div class="viewcode-block" id="HmacKey.generate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.HmacKey.generate">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">generate</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span>
        <span class="n">session</span><span class="p">,</span>
        <span class="n">object_id</span><span class="p">,</span>
        <span class="n">label</span><span class="p">,</span>
        <span class="n">domains</span><span class="p">,</span>
        <span class="n">capabilities</span><span class="p">,</span>
        <span class="n">algorithm</span><span class="o">=</span><span class="n">ALGORITHM</span><span class="o">.</span><span class="n">HMAC_SHA256</span><span class="p">,</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Generate a new HMAC key in the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param ALGORITHM algorithm: (optional) The algorithm to use for the HMAC</span>
<span class="sd">            key.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: HmacKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQB&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">algorithm</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">GENERATE_HMAC_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="HmacKey.put"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.HmacKey.put">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span>
        <span class="n">session</span><span class="p">,</span>
        <span class="n">object_id</span><span class="p">,</span>
        <span class="n">label</span><span class="p">,</span>
        <span class="n">domains</span><span class="p">,</span>
        <span class="n">capabilities</span><span class="p">,</span>
        <span class="n">key</span><span class="p">,</span>
        <span class="n">algorithm</span><span class="o">=</span><span class="n">ALGORITHM</span><span class="o">.</span><span class="n">HMAC_SHA256</span><span class="p">,</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Import an HMAC key into the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param bytes key: The raw key corresponding to the algorithm.</span>
<span class="sd">        :param ALGORITHM algorithm: (optional) The algorithm to use for the HMAC</span>
<span class="sd">            key.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: HmacKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="p">(</span>
            <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
                <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQB&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
                <span class="n">object_id</span><span class="p">,</span>
                <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
                <span class="n">domains</span><span class="p">,</span>
                <span class="n">capabilities</span><span class="p">,</span>
                <span class="n">algorithm</span><span class="p">,</span>
            <span class="p">)</span>
            <span class="o">+</span> <span class="n">key</span>
        <span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">PUT_HMAC_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="HmacKey.sign_hmac"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.HmacKey.sign_hmac">[docs]</a>    <span class="k">def</span> <span class="nf">sign_hmac</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Calculate the HMAC signature of the given data.</span>

<span class="sd">        :param bytes data: The data to sign.</span>
<span class="sd">        :return: The signature.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">SIGN_HMAC</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="HmacKey.verify_hmac"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.HmacKey.verify_hmac">[docs]</a>    <span class="k">def</span> <span class="nf">verify_hmac</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">signature</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;</span>
<span class="sd">        Verify an HMAC signature.</span>

<span class="sd">        :param bytes signature: The signature to verify.</span>
<span class="sd">        :param bytes data: The data to verify the signature against.</span>
<span class="sd">        :return: True if verification succeeded, False if not.</span>
<span class="sd">        :rtype: bool</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">signature</span> <span class="o">+</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">VERIFY_HMAC</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span> <span class="o">==</span> <span class="sa">b</span><span class="s2">&quot;</span><span class="se">\1</span><span class="s2">&quot;</span></div></div>


<div class="viewcode-block" id="Template"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.Template">[docs]</a><span class="k">class</span> <span class="nc">Template</span><span class="p">(</span><span class="n">YhsmObject</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Binary template used to validate SSH certificate requests.</span>

<span class="sd">    Supported algorithms:</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.TEMPLATE_SSH`</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="n">object_type</span> <span class="o">=</span> <span class="n">OBJECT</span><span class="o">.</span><span class="n">TEMPLATE</span>

<div class="viewcode-block" id="Template.put"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.Template.put">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put</span><span class="p">(</span><span class="bp">cls</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">algorithm</span><span class="p">,</span> <span class="n">data</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Import a Template into the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param ALGORITHM algorithm: The algorithm to use for the template.</span>
<span class="sd">        :param bytes data: The template data.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: Template</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQB&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">algorithm</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="n">msg</span> <span class="o">+=</span> <span class="n">data</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">PUT_TEMPLATE</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="Template.get"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.Template.get">[docs]</a>    <span class="k">def</span> <span class="nf">get</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Read a Template from the YubiHSM.</span>

<span class="sd">        :return: The template data.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">GET_TEMPLATE</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div></div>


<div class="viewcode-block" id="OtpData"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.OtpData">[docs]</a><span class="k">class</span> <span class="nc">OtpData</span><span class="p">(</span>
    <span class="n">namedtuple</span><span class="p">(</span>
        <span class="s2">&quot;OtpData&quot;</span><span class="p">,</span> <span class="p">[</span><span class="s2">&quot;use_counter&quot;</span><span class="p">,</span> <span class="s2">&quot;session_counter&quot;</span><span class="p">,</span> <span class="s2">&quot;timestamp_high&quot;</span><span class="p">,</span> <span class="s2">&quot;timestamp_low&quot;</span><span class="p">]</span>
    <span class="p">)</span>
<span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Decrypted OTP counter values.</span>

<span class="sd">    :param int use_counter: 16 bit counter incremented on each power cycle.</span>
<span class="sd">    :param int session_counter: 8 bit counter incremented on each touch.</span>
<span class="sd">    :param int timestamp_high: 8 bit high part of the timestamp.</span>
<span class="sd">    :param int timestamp_low: 16 bit low part of the timestamp.</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="vm">__slots__</span> <span class="o">=</span> <span class="p">()</span></div>


<div class="viewcode-block" id="OtpAeadKey"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.OtpAeadKey">[docs]</a><span class="k">class</span> <span class="nc">OtpAeadKey</span><span class="p">(</span><span class="n">YhsmObject</span><span class="p">):</span>
    <span class="sd">&quot;&quot;&quot;Used to decrypt and use a Yubico OTP AEAD for OTP decryption.</span>

<span class="sd">    Supported algorithms:</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.AES128_YUBICO_OTP`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.AES192_YUBICO_OTP`</span>
<span class="sd">        - :class:`~yubihsm.defs.ALGORITHM.AES256_YUBICO_OTP`</span>
<span class="sd">    &quot;&quot;&quot;</span>

    <span class="n">object_type</span> <span class="o">=</span> <span class="n">OBJECT</span><span class="o">.</span><span class="n">OTP_AEAD_KEY</span>

<div class="viewcode-block" id="OtpAeadKey.put"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.OtpAeadKey.put">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">put</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">algorithm</span><span class="p">,</span> <span class="n">nonce_id</span><span class="p">,</span> <span class="n">key</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Import an OTP AEAD key into the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param ALGORITHM algorithm: The algorithm to use for the key.</span>
<span class="sd">        :param int nonce_id: The nonce ID used for AEADs.</span>
<span class="sd">        :param bytes key: The key to import, corresponding to the algorithm.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: AsymmetricKey</span>

<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQB&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">algorithm</span><span class="p">,</span>
        <span class="p">)</span> <span class="o">+</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;&lt;I&quot;</span><span class="p">,</span> <span class="n">nonce_id</span>
        <span class="p">)</span>  <span class="c1"># nonce ID is stored in little-endian.</span>
        <span class="n">msg</span> <span class="o">+=</span> <span class="n">key</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">PUT_OTP_AEAD_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="OtpAeadKey.generate"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.OtpAeadKey.generate">[docs]</a>    <span class="nd">@classmethod</span>
    <span class="k">def</span> <span class="nf">generate</span><span class="p">(</span>
        <span class="bp">cls</span><span class="p">,</span> <span class="n">session</span><span class="p">,</span> <span class="n">object_id</span><span class="p">,</span> <span class="n">label</span><span class="p">,</span> <span class="n">domains</span><span class="p">,</span> <span class="n">capabilities</span><span class="p">,</span> <span class="n">algorithm</span><span class="p">,</span> <span class="n">nonce_id</span>
    <span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Generate a new OTP AEAD key in the YubiHSM.</span>

<span class="sd">        :param AuthSession session: The session to import via.</span>
<span class="sd">        :param int object_id: The ID to set for the object. Set to 0 to let the</span>
<span class="sd">            YubiHSM designate an ID.</span>
<span class="sd">        :param str label: A text label to give the object.</span>
<span class="sd">        :param int domains: The set of domains to assign the object to.</span>
<span class="sd">        :param int capabilities: The set of capabilities to give the object.</span>
<span class="sd">        :param ALGORITHM algorithm: The algorithm to use for the key.</span>
<span class="sd">        :return: A reference to the newly created object.</span>
<span class="sd">        :rtype: OtpAeadKey</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span>
            <span class="s2">&quot;!H</span><span class="si">%d</span><span class="s2">sHQBL&quot;</span> <span class="o">%</span> <span class="n">LABEL_LENGTH</span><span class="p">,</span>
            <span class="n">object_id</span><span class="p">,</span>
            <span class="n">_label_pack</span><span class="p">(</span><span class="n">label</span><span class="p">),</span>
            <span class="n">domains</span><span class="p">,</span>
            <span class="n">capabilities</span><span class="p">,</span>
            <span class="n">algorithm</span><span class="p">,</span>
            <span class="n">nonce_id</span><span class="p">,</span>
        <span class="p">)</span>
        <span class="k">return</span> <span class="bp">cls</span><span class="o">.</span><span class="n">_from_command</span><span class="p">(</span><span class="n">session</span><span class="p">,</span> <span class="n">COMMAND</span><span class="o">.</span><span class="n">GENERATE_OTP_AEAD_KEY</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="OtpAeadKey.create_otp_aead"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.OtpAeadKey.create_otp_aead">[docs]</a>    <span class="k">def</span> <span class="nf">create_otp_aead</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">key</span><span class="p">,</span> <span class="n">identity</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Create a new Yubico OTP credential AEAD.</span>

<span class="sd">        :param bytes key: 16 byte AES key for the credential.</span>
<span class="sd">        :param bytes identity: 6 byte private ID for the credential.</span>
<span class="sd">        :return: A new AEAD.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">key</span> <span class="o">+</span> <span class="n">identity</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">CREATE_OTP_AEAD</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="OtpAeadKey.randomize_otp_aead"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.OtpAeadKey.randomize_otp_aead">[docs]</a>    <span class="k">def</span> <span class="nf">randomize_otp_aead</span><span class="p">(</span><span class="bp">self</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Create a new Yubico OTP credential AEAD using random data.</span>

<span class="sd">        :return: A new AEAD.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">RANDOMIZE_OTP_AEAD</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div>

<div class="viewcode-block" id="OtpAeadKey.decrypt_otp"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.OtpAeadKey.decrypt_otp">[docs]</a>    <span class="k">def</span> <span class="nf">decrypt_otp</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">aead</span><span class="p">,</span> <span class="n">otp</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Decrypt a Yubico OTP using an AEAD.</span>

<span class="sd">        :param bytes aead: The AEAD containing encrypted credential data.</span>
<span class="sd">        :param bytes otp: The 16 byte encrypted OTP payload to decrypt.</span>
<span class="sd">        :return: The decrypted OTP data.</span>
<span class="sd">        :rtype: OtpData</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!H&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">)</span> <span class="o">+</span> <span class="n">aead</span> <span class="o">+</span> <span class="n">otp</span>
        <span class="n">resp</span> <span class="o">=</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">DECRYPT_OTP</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span>
        <span class="k">return</span> <span class="n">OtpData</span><span class="p">(</span><span class="o">*</span><span class="n">struct</span><span class="o">.</span><span class="n">unpack</span><span class="p">(</span><span class="s2">&quot;&lt;HBBH&quot;</span><span class="p">,</span> <span class="n">resp</span><span class="p">))</span></div>

<div class="viewcode-block" id="OtpAeadKey.rewrap_otp_aead"><a class="viewcode-back" href="../../rst/yubihsm.html#yubihsm.objects.OtpAeadKey.rewrap_otp_aead">[docs]</a>    <span class="k">def</span> <span class="nf">rewrap_otp_aead</span><span class="p">(</span><span class="bp">self</span><span class="p">,</span> <span class="n">new_key_id</span><span class="p">,</span> <span class="n">aead</span><span class="p">):</span>
        <span class="sd">&quot;&quot;&quot;Decrypt and re-encrypt an AEAD from one key to another.</span>

<span class="sd">        :param int new_key_id: The ID of the OtpAeadKey to wrap to.</span>
<span class="sd">        :param bytes aead: The AEAD to re-wrap.</span>
<span class="sd">        :return: The new AEAD.</span>
<span class="sd">        :rtype: bytes</span>
<span class="sd">        &quot;&quot;&quot;</span>
        <span class="n">msg</span> <span class="o">=</span> <span class="n">struct</span><span class="o">.</span><span class="n">pack</span><span class="p">(</span><span class="s2">&quot;!HH&quot;</span><span class="p">,</span> <span class="bp">self</span><span class="o">.</span><span class="n">id</span><span class="p">,</span> <span class="n">new_key_id</span><span class="p">)</span> <span class="o">+</span> <span class="n">aead</span>
        <span class="k">return</span> <span class="bp">self</span><span class="o">.</span><span class="n">session</span><span class="o">.</span><span class="n">send_secure_cmd</span><span class="p">(</span><span class="n">COMMAND</span><span class="o">.</span><span class="n">REWRAP_OTP_AEAD</span><span class="p">,</span> <span class="n">msg</span><span class="p">)</span></div></div>
</pre></div>

           </div>
           
          </div>
          <footer>

  <hr/>

  <div role="contentinfo">
    <p>
        &#169; Copyright 2018, Yubico.

    </p>
  </div>
    
    
    
    Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
    
    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
    
    provided by <a href="https://readthedocs.org">Read the Docs</a>. 

</footer>
        </div>
      </div>

    </section>

  </div>
  

  <script type="text/javascript">
      jQuery(function () {
          SphinxRtdTheme.Navigation.enable(true);
      });
  </script>

  
  
    
   

</body>
</html>